NIST AI RMF, MeasureMEASURE 2.11

Certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.

For models using advanced techniques such as AI/ML, model owners should consider the level of transparency and explainability required, the need for alternative controls, and the potential for biased outcomes, negative social and ethical implications or privacy risks.

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.

Do not unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, in any insurance practice.

Where the Commissioner of Insurance has adopted implementing rules for your type of insurance and practice, do not use an external consumer data and information source, or an algorithm or predictive model that uses one, in a way that unfairly discriminates on those same grounds.

Institutions should understand the quality of data and inputs to the model, detect and prevent bias in the credit decision-making process, and ensure safeguards for the confidentiality, integrity and availability of information and systems (paragraph 53(e)).

Institutions should have in place internal policies and procedures detecting and preventing bias and ensuring the quality of the input data, and measures to ensure the traceability, auditability, and robustness and resilience of the inputs and outputs (paragraph 54(a) and (b)).

Do not use artificial intelligence in a way that has the effect of subjecting an employee or applicant to discrimination on the basis of a protected class, and do not use a zip code as a proxy for a protected class, in recruitment, hiring, promotion, discipline, discharge, or the terms and conditions of employment.

Use such systems with respect for the worker's dignity and confidentiality and the principle of non-discrimination.

The CBJ expects you to review and validate AI data, models and decisions to detect and mitigate bias, to conduct periodic AI Impact Assessments proportional to risk, to validate and robustness-test models, and to monitor AI performance continuously at a level matched to the use case and risk (sections 2.5, 2.6, 5.2 and 5.3).

The Commission advises you to identify and mitigate biases in AI algorithms and datasets, and to perform regular audits to assess and address biases in AI models.

A QCB-regulated entity deploying a High-Risk AI system must maintain an AI system register, adopt an AI governance policy, conduct risk and bias assessments, and provide human oversight of the system's decisions.

Make reasonable efforts to identify any clinical decision support system you develop or deploy that is known or has a reasonably foreseeable risk of biased impacts in health programs or activities

Do not base a utilization review determination solely on group data without reference to the individual's data, and do not use the system in a way that discriminates against individuals in violation of state or federal law

Apply data governance and management practices appropriate to the system's intended purpose, covering your design choices; how you collected the data and, for personal data, why you originally collected it; your data-preparation operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation; the assumptions you made about what the data measures and represents; an assessment of whether the data sets you need are available, sufficient in quantity, and suitable; examination of the data for biases likely to affect health and safety, harm fundamental rights, or lead to discrimination prohibited under Union law, especially where one operation's data outputs become a later operation's inputs; and measures to detect, prevent and mitigate any bias you find.

If your high-risk AI system continues to learn after it is placed on the market or put into service, develop it to eliminate or reduce as far as possible the risk of biased outputs feeding back into future operations, and put mitigation measures in place for any feedback loop that remains.

Ensure the tool is fairly and equitably applied and does not result in unfair discrimination or directly or indirectly cause harm to an enrollee.

If you provide or deploy an automated employment decision tool for use on New Jersey applicants or employees, including a tool that scores, ranks, or classifies candidates or that assesses schedule availability, adequately test it before use to confirm it does not adversely affect a protected class.

Conduct regular impact assessments of the high-risk AI system for algorithmic discrimination.

Before screening a candidate or employee in New York City with an automated employment decision tool, a product must be the subject of a bias audit performed within the prior year, publish a summary of that audit, and notify each affected candidate or employee at least ten business days beforehand of the tool's use and the job qualifications and characteristics it assesses.

If you are a provider of a high-risk AI system, you may exceptionally process special categories of personal data to the extent strictly necessary to detect and correct bias under Article 10(2), points (f) and (g), provided all six conditions of Article 4a(1) are met: the bias cannot be effectively addressed with other data, including synthetic or anonymised data; the data is subject to technical re-use limits and state-of-the-art security, including pseudonymisation; the data is secured with strict access controls and documented access; the data is not transmitted, transferred, or otherwise accessed by other parties; the data is deleted once the bias is corrected or its own retention period ends, whichever comes first; and your records of processing activities under the GDPR, the EU institutions data protection regulation, or the law enforcement directive state why the processing was strictly necessary and why other data could not achieve the same result.

Guide your use of artificial intelligence by respect for fundamental rights, balancing explainability, security, transparency and responsibility, and set up processes to avoid bias and discrimination (Article 9(1)).

Do not let a decision made using an algorithmic system result in discrimination on a ground Kazakhstani law sets out.